A 21st field in a config file crashed 8.5 million Windows machines in 90 minutes. Not malware. A routine update from a trusted vendor. On July 19, 2024, CrowdStrike pushed a detection update. Their cloud validator checked it against a new 21-field schema and approved it. The interpreter in the Windows kernel still expected 20. Out-of-bounds read. Instant blue screen. The cruel part: the crash hit so early in boot the management agent never loaded, so endpoints couldn't receive the rollback command. Delta booted 40,000 servers into Safe Mode and deleted the file by hand. Recovery took five days; $550M lost. In our work, CrowdStrike is the case study, not the cause. A typical enterprise endpoint runs 8-12 kernel-level agents — EDR, DLP, encryption, patching, VPN. Each on its own channel and schedule. Your change advisory board reviews internal deployments and waves vendor updates through, because "we trust the vendor." No independent layer sits between a vendor's update pipeline and your endpoints. SBOM tools scan open-source code, not proprietary kernel pushes. Delta had opted out of auto-updates; the kernel agent forced the channel file anyway, which is why the May 2025 ruling let negligence and computer-trespass claims clear the liability cap. "We trust the vendor" is now a board-level question, not an IT one. If your team ran an update-risk review after CrowdStrike, was it a one-time exercise or a permanent capability you can show the board? #ITResilience #CyberRisk